ppkarwasz commented on code in PR #288:
URL: https://github.com/apache/commons-jxpath/pull/288#discussion_r3944937277
##########
src/main/java/org/apache/commons/jxpath/xml/JDOMParser.java:
##########
@@ -40,7 +45,19 @@ public Object parseXML(final InputStream stream) {
throw new JXPathException("JDOM parser configuration error. JDOM
does not support the namespaceAware=false setting.");
}
try {
- final SAXBuilder builder = new SAXBuilder();
+ // JDOM builds its reader through JAXP internally; hand it one
from the secure factory instead.
+ final SAXBuilder builder = new SAXBuilder() {
+ @Override
+ protected XMLReader createParser() throws JDOMException {
+ try {
+ final SAXParserFactory factory =
SecureSAXParserFactory.newNSInstance();
+ factory.setValidating(isValidating());
+ return factory.newSAXParser().getXMLReader();
+ } catch (final Exception ex) {
+ throw new JDOMException("Unable to create a new XML
reader", ex);
+ }
+ }
+ };
Review Comment:
Good point.
This value is set on the factory, the others on the builder.
BTW: we are still using JDOM 1, which was released 14 years ago, instead of
JDOM 2, which is more recent although mostly dormant.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
